Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Risk & Compliance · Question Set
Risk & Compliance Basics interview questions for placements and exams.
Questions
14
Included in this set
Subject
Risk & Compliance
Explore more sets
Difficulty
Mixed
Level of this set
Go through each question and its explanation. Use this set as a focused practice pack for Risk & Compliance .
Phishing attacks exploit human behavior rather than system flaws. Attackers trick users into revealing sensitive data or clicking malicious links by posing as trusted entities. These attacks depend on manipulation and persuasion rather than hacking technology directly.
For complete preparation, combine this set with full subject-wise practice for Risk & Compliance . You can also explore other subjects and sets from the links below.
An attack surface includes every pathway that could allow unauthorized access or data leakage. It includes open ports, APIs, user accounts, or misconfigured services. Reducing the attack surface means closing unnecessary paths and strengthening those that must remain open.
A cybersecurity threat is any circumstance or event with the potential to negatively impact operations or assets. It can exploit vulnerabilities and cause unauthorized access, loss of data, or system disruption. Examples include malware, insider misuse, or natural disasters that affect IT systems.
A vulnerability is a flaw, misconfiguration, or weakness that can be abused. An exploit is the technique or tool that takes advantage of that weakness. For example, an outdated web server may have a vulnerability, and a specially crafted request is the exploit that compromises it.
Risk represents the possibility of a negative event occurring when a threat successfully exploits a vulnerability. It combines the chance of the event happening with the severity of its outcome. Managing risk means understanding what could go wrong and taking steps to reduce that likelihood or impact.
Preventive controls aim to stop incidents before they occur, such as firewalls or access controls. Detective controls identify when something happens, like intrusion detection or log monitoring. Corrective controls act after an incident to restore normal operations, such as backups or patching.
The principle of least privilege means limiting access rights to the minimum necessary. Each account, process, or device operates with the smallest set of permissions required to perform its tasks. This limits damage if credentials or systems are compromised.
The first action after identifying a security incident is containment. Containment stops the attack from spreading or causing more harm. After that comes eradication of the threat, system recovery, and a review to prevent future occurrences.
A threat is anything that can cause harm, such as malware or an insider attack. A vulnerability is a weakness that makes a system open to that threat. Risk is the potential loss or damage when the threat exploits the vulnerability. For instance, an unpatched server is a vulnerability, ransomware is the threat, and the chance of losing data is the risk.
The process begins by identifying assets and their related risks. Next comes assessing how likely each risk is and what impact it could have. Based on that, you decide how to treat it — mitigate, transfer, avoid, or accept. Finally, you monitor and review because risks change as systems and threats evolve.
Governance defines how security is led and controlled within an organization. It sets accountability, decision-making, and reporting structures. Good governance ensures that cybersecurity supports business goals, not just technical operations, and that responsibilities are clearly assigned across all levels.
Human behavior often determines whether attacks succeed or fail. Awareness programs teach employees how to recognize phishing, use strong passwords, and handle data safely. Regular training turns users into active defenders rather than weak points in the system.
These frameworks create structure and consistency in managing security. ISO 27001 focuses on building and maintaining an information security management system, while NIST provides clear technical and process-level guidance. Both help organizations assess risks, apply controls, and continuously improve their defenses.
The CIA Triad is the foundation of cybersecurity. Confidentiality means keeping data private and accessible only to authorized users. Integrity ensures that data remains accurate and unchanged unless properly authorized. Availability ensures that systems and information are accessible when needed by legitimate users. Together, these three principles guide how we secure any information system.